0c201f6d1938cda7731f5abf45a2f51d1ecc3460d02d868b8fd8354993372a80

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 12:35

Target

5388b66b978ea64ef210dd613b6f4fd8.dll
Size

11KB
MD5

5388b66b978ea64ef210dd613b6f4fd8
SHA1

247d68d722ec380b51954eee2d4e2300cf2243bd
SHA256

0c201f6d1938cda7731f5abf45a2f51d1ecc3460d02d868b8fd8354993372a80
SHA512

aa1b2098fc2e18e568c4c128750395dd8f58bcb06ff4b4a87e62d716daa095a3c41e9d0fd2124e3498fc99e2b57376437c00e1a1509ccd4a077c1e6cecc630b6
SSDEEP

192:qSnRvQm66qpqqsA3htwPpntceeTgURdTOzYVYjdlTDWmHxxCOcG/mYSnjQG/agAh:qSRvQmQsqdR6k1Rd1c7CbG/mYSt/1AdT

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1084	2976	rundll32.exe	90
PID 2976 wrote to memory of 1084	2976	rundll32.exe	90
PID 2976 wrote to memory of 1084	2976	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5388b66b978ea64ef210dd613b6f4fd8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5388b66b978ea64ef210dd613b6f4fd8.dll,#1
  2⤵
  PID:1084

memory/1084-0-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download